ShieldFont, a web font project developed by Isaque Seneda and Gabriel Abrucio with support from the Playtype type foundry, is designed to fight AI scraping by handing crawlers the wrong words. A person reading in a browser sees the writing as written. A scraper pulling the HTML gets different words in the same grammar, at the same URL, off the same bytes. The project began in October 2025 and has since been described by its creators as a tool for a creative resistance movement, aimed at writers, artists, and anyone who wants to protect their creativity from being harvested by machines.
“We think this font is for people who want to join a creative resistance movement and are willing to pay a small price to do so,” Abrucio has said. The main cost is reach through search engine optimization, but authors can shield only key parts of their content and leave the rest available for indexing. He has also drawn a boundary around the project: those who need to minimize friction at all costs, especially when profit or clarity is the main goal, should probably walk away. Traditional design rules favor user comfort, but the argument is that in a changing world the rulebook sometimes needs to be rewritten, especially when the goal is resistance.
How ShieldFont works
Fonts have always been allowed to draw one thing when the code says another. The classic example is the f and i ligature: type those two letters together, and most fonts merge the pair into a single joined shape so the characters stop colliding. Those substitution rules exist for typographic tidiness. ShieldFont points them at whole words.
A build step swaps the words in the page’s code first, exchanging each one for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer chose. Anything reading the code without drawing the page keeps the swap, which covers scrapers, copy-paste into a text tool, and language models digesting raw HTML. The human eye, guided by the rendered font, reconstructs the intended text without ever seeing the encoded layer.
The swap has to happen on the writer’s own machine or server. Hand the job to the reader’s browser and the entire dictionary ships alongside the page, real words included. The site looks protected, but the plain text sits in a file anyone can open. Keeping the transformation server-side ensures the decoy is the only version available in the source code, while the font alone carries the visual mapping needed to display the real content.
The project is built on a simple but powerful insight: the same bytes can mean different things depending on whether they are rendered or read as text. For a search engine or AI crawler that never renders the page, the decoy words become the content. For a human using a graphical browser, the rendered glyphs display what the author actually wrote. This split between visual and textual meaning is what makes ShieldFont effective against the cheapest and most common forms of scraping.
Readers do the work the machines cannot
ShieldFont does not provide perfect protection. A blog’s RSS feed leaks the whole post in plain English on most platforms by default, because feeds are built from the source data before any font touches it. Screen readers also get the protected region hidden from them, so nobody hears a decoy read aloud. To address that, the project offers an alternative that makes the reader’s browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified, while NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves.
The friction is intentional. Seneda has described the project’s friction as an invitation for users to donate their “brain compute” to help keep content from being stolen. One of the core insights is that there are certain compute tasks the human brain can solve at a much lower cost than machines right now, not only processing the pixels of a rendered font but also tasks like finding a button, whether through vision or audio, which are expensive for machines at scale. The goal is to allow everyone to help with their brains, regardless of their ability.
Seneda puts a price on that idea. “We don’t think people realize how efficient biological brains are,” he has said. “Humans have compute, and that compute is worth money, and we can use it and put it into this fight. It comes down to a battle of commodities: human compute vs. machine compute.” This framing shifts the conversation from simple copy protection to an economic argument about the cost of unauthorized extraction.
Anyone holding the font can undo it
The defensive technique has limits. Every one of the 11,962 word pairs in the default dictionary can be reversed using the shipped font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots do the same. Frequency analysis across a large corpus works against a static dictionary. In other words, ShieldFont is not unbreakable cryptography; it is a cost multiplier.
The reading gap has offensive research behind it. In March 2026, LayerX Security published a demonstration called “Poisoned Typeface,” in which researcher Roy Paz built a page that showed a human one thing and handed AI assistants another using a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven AI assistants read the page and called it safe, including ChatGPT, Claude, Gemini, and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks. That research illustrates how widely deployed assistants can be confused when visual rendering and underlying text diverge.
The measured damage
ShieldFont’s creators have measured how much disruption their swaps cause to language models. Swap about a quarter of a page’s words, and the meaning fails to survive in 55.8% of news passages tested. General web text sits close to half, and fiction near a third. Seneda and Abrucio decline to claim the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument. Their caution suggests that the real-world impact on AI training pipelines depends on how the content is ingested and what downstream tasks are evaluated.
These numbers matter because the threat model is not about stopping every sophisticated adversary. The goal is to make the cheapest and most scalable scraping methods less reliable. If a model training pipeline simply downloads raw HTML and extracts text, ShieldFont can introduce enough noise to degrade the training signal. If the pipeline uses a headless browser or OCR, the defense is weaker, but the computational cost is higher. That trade-off is precisely where the project intends to create friction.
The bet is on the price of a page
Seneda puts the economics in cents. “We think about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario,” he has said. That gap is real money, even if it is still only cents per page. It already serves as a small deterrent at scale, but the team believes it can find more ways to increase that cost. The long-term vision is a future where a scraper must solve a different, highly complex cybersecurity puzzle for every page.
The repository ships four mapping variants and a script that mints a private mapping from a seed of the author’s choosing. Per-deploy rotation, meaning per-site seeds and time windows, sits under near-term roadmap priorities. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker’s cost. Dictionary rotation and bring-your-own-key are already included, giving authors flexibility to avoid static analysis.
What the price buys, in Seneda’s account, is leverage. “That could give writers real bargaining power against big tech and help restore the incentive to share work online,” he has said. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing, weakening the internet’s collaborative nature. The benefit is primarily cultural, he argues. Abrucio places the cost alongside things publishers already charge readers for. He sees every form of protection as introducing friction, from CAPTCHAs to paywalls, and views ShieldFont’s trade-offs as an investment in human creativity that sparks debate around the ethics of AI training while making unauthorized scraping more costly and riskier.
What it stops and what it does not
The code is free to take and build on, but the font that ships with it stays Playtype’s property. A designer who wants a font of their own to give away has to build one on an open base. A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end of the scraping ecosystem, meaning the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages, so the practical impact can still be substantial.
ShieldFont is available for free on GitHub, allowing any writer or publisher to experiment with the technique. The project is not a complete solution to AI copyright concerns, but it represents a growing movement of creators using technical ingenuity to reclaim control over their words. By forcing the cheapest forms of automated extraction to fail, it raises the cost of theft and encourages a broader conversation about how online content should be used in the age of large language models.
Source: Help Net Security News